SA-CONTRIB-2026-153: Critical severity drupal/ultimate_table_field vulnerability
The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file. The module doesn't sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous users, who can open the dialog for any cell type. The dialog allows uploading files to the server location. This vulnerability is partially mitigated by the fact that only files with the pdf, doc and docx extensions are accepted.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/ultimate_table_fieldto a version that resolves this vulnerability.Fixed in 2.0.1Fixed in 1.1.1 - Compensating control
Restrict access to the cell editor dialog route used by the Ultimate Table Field module so it is not reachable by anonymous users (e.g., require authentication/deny anonymous access).
Event History
Frequently Asked Questions
Who can exploit this issue?
Anonymous users can access the route that opens the cell editor dialog, including dialogs for any cell type. No authenticated account is required to reach that route.
What can an attacker do through the exposed dialog?
The dialog allows files to be uploaded to the server location. Uploads are limited to files with pdf, doc, and docx extensions.
Is there any mitigation described for environments that cannot patch immediately?
The available partial mitigation is the module's extension restriction: only pdf, doc, and docx files are accepted. No additional workaround or configuration change is provided in the available data.